North Korean fake job interview led to $6.3B Binance heist
‘It was not a single isolated breach or a simple phishing incident,’ exchange says
North Korean cryptocurrency thieves tricked a Binance software engineer into downloading malware onto their work-issued computer during a fake job interview process before last week’s record-breaking $6.3 billion heist.
In an incident report published on Tuesday, the cryptocurrency exchange said several techniques - including social engineering via fake job interviews, malware downloads, compromised internal AI tooling, endpoint takeover, and an “advanced transaction-authorization method” - led to the October 29 security breach.
“Our current investigation indicates that this was a sophisticated, multi-stage campaign,” the incident report said. “It was not a single isolated breach or a simple phishing incident.”
Over the weekend, the FBI attributed the theft to TraderTraitor, a North Korean hacking operation linked to Lazarus Group, known for combining espionage with massive cryptocurrency heists. The Pyongyang-backed crew is also highly adept at job market scams - both posing as IT workers, who are then hired by Western companies, and as potential employers to lure software engineers into downloading malware and infecting corporate devices.
With the recent Binance attack, the Norks used the latter.
The attack prep began back in June with a supply chain attack when one of its engineers downloaded a malicious Homebrew installation. While the malware was detected by the security team, the device was replaced, and all affected credentials rotated, “Engineer A’s role and his related colleagues on our wallet infrastructure team was exposed to the hacker,” the report says.
Three months later, the social engineering part of the attack happened.
In September, another software engineer was contacted via a “legitimate job-hunting platform” by someone purporting to be a project director who arranged a series of job interviews for the Binance engineer with the fake company. During the first round - a live video interview with the engineer and a fake HR rep - the interviewer “shared a social media account with him, including personal photos and videos posted on the platform, in order to build trust,” according to the report. “This was more advanced and deceptive than previously seen social engineering approaches.”
The second interview with someone purporting to be the CEO of the phony company was conducted on a “popular social chat app,” and toward the end, the CEO instructed the engineer to download an “assignment” containing a malware-laced code repository. The code executed on his work computer during the setup process, which kicked off a series of unauthorized activities.
According to Binance, the malware replaced a legitimate development tool component with a malicious version, which executed commands and established communication with an attacker-controlled external server. The attackers also took steps to hide the malicious script and evade detection, and it worked. Binance’s endpoint security tools did not immediately detect the malware.
CREATE /opt/homebrew/Cellar/pyenv/2.8.0/libexec/pyenv_
MODIFY pyenv_ → 3,414 B
DELETE …/libexec/pyenv (3,344 B) ← remove the valid pyenv
RENAME pyenv_ → pyenv (3,414 B) ← replace it with a malicious version
DELETE /opt/homebrew/bin/pyenv (3,414 B)
ln (create a new symlink) + spawn zsh
Then, on October 20, the miscreants used the compromised computer and an internal AI tool to gain access to the computers of wallet DevOps engineer A and another wallet software developer, Engineer C.
Engineer A had a container deployment permission token on his computer, which the Norks soon discovered. On October 29, the attacker accessed Engineer C’s computer, used the stolen credentials from Engineer A to deploy a container, and triggered a script to launch the cryptocurrency-stealing attack.
As of Tuesday, Binance said it has rebuilt the compromised wallet system and internal AI tool, and replaced all of the affected devices. It also decommissioned all credentials and tokens assigned to the compromised engineers, and is working with law enforcement, blockchain intel firms, and security researchers to trace and freeze the assets.
The crypto exchange has also hired independent cybersecurity experts to conduct a cybersecurity review of the incident, and recommend additional protective measures. Binance said it’s also working to establish a security research fund and initiatives with AI companies and security shops to focus on AI security in blockchain environments.®
More than two years after promising it, Apple lets developers test Siri AI app integration
Alex Karp casts military software as a force for peace while declaring a moral imperative to dominate the market
PARTNER CONTENT: 300+ AI applications delivering surges in core metrics and annual cost reduction of over CNY100m
Who needs a humanoid to pick up after you when you can suspend an AI-powered claw from cables near your ceiling?
Flash the cash, flush the cache
FLIP reveals a planet hidden in Webb data, boosting detection sensitivity by up to 15 times
Firms still want kit on-premises, but spike in revenue is as much about increased costs as higher sales
Customers sweating assets amid tight budgets, as Microsoft execs get creative with sales pitches
But first it needs planning permission, government approval and, rather importantly, a customer
Revised IPO filing warns 12x revenue growth is unlikely to continue
IP house believes optics demand is going to explode as Nvidia and others eye bigger systems
PLUS: US takes down Iranian propaganda sites; Marketing company asks ‘Why Do We Have Your Information?’ And more!
PLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more
Black Hat and DEF CON
Voting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included
Went at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified
On the plus side, infosec’s a good bet for a long, stable career
Very nearly 30something environment gets spruced up… and there’s a new Trinity, too
OpenVDDK is reportedly already being used in production, at scale
Combining the NetBSD kernel with the Alpine Linux userland
Canonical has a long way to catch up, but it knows who it’s chasing
What’s even better than Rust in the Linux kernel? Rust in systemd!
Daemonarchy is unaffiliated with the Linux original, built with AI help, and could complicate FreeBSD’s debate over AI contributions